"absolutely necessary" does not mean anything. For example, tracking in banking systems has very good justifications such as fraud detection. That alone means banks have a blank check to connect tons of features about their users, and not for nefarious purposes.
[EDIT] to your EDIT point: even with server logs you could start building user tracking and if your net is large enough you can derive a massive amount of data just from that. Pattern analysis, sites/services users connect to, geolocation, etc... even without the most sophisticated tracking systems this is already good enough to build business value.
"waaaah but we need to share it with 'partners'" hahaha OK whatever, but bet you don't though. Illegal. Figure it out. Bet you can.
You don't need to keep the data long-term (though it would be more profitable if you could). You can still get a lot of value using the data to train an ML model, then use that model to build valuable decision-making systems, which few other companies could produce.
Plus, banks training models for fraud detection has an obvious benefit to everyone.
[EDIT] my point is there's a ton of info being collected that goes way beyond web server logging, so I don't know how this became about why all this is impossible because server logs are a thing.